inspec-core 2.1.67

data/lib/inspec/profile_context.rb

@@ -0,0 +1,208 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+require 'inspec/log'
+require 'inspec/rule'
+require 'inspec/resource'
+require 'inspec/library_eval_context'
+require 'inspec/control_eval_context'
+require 'inspec/require_loader'
+require 'securerandom'
+require 'inspec/objects/attribute'
+
+module Inspec
+  class ProfileContext
+    def self.for_profile(profile, backend, attributes)
+      new(profile.name, backend, { 'profile' => profile,
+                                   'attributes' => attributes,
+                                   'check_mode' => profile.check_mode })
+    end
+
+    attr_reader :attributes, :profile_id, :resource_registry, :backend
+    attr_accessor :rules
+    def initialize(profile_id, backend, conf)
+      if backend.nil?
+        raise 'ProfileContext is initiated with a backend == nil. ' \
+             'This is a backend error which must be fixed upstream.'
+      end
+      @profile_id = profile_id
+      @backend = backend
+      @conf = conf.dup
+      @skip_only_if_eval = @conf['check_mode']
+      @rules = {}
+      @control_subcontexts = []
+      @lib_subcontexts = []
+      @require_loader = ::Inspec::RequireLoader.new
+      @attributes = []
+      # A local resource registry that only contains resources defined
+      # in the transitive dependency tree of the loaded profile.
+      @resource_registry = Inspec::Resource.new_registry
+      @library_eval_context = Inspec::LibraryEvalContext.create(@resource_registry, @require_loader)
+      @current_load = nil
+    end
+
+    def dependencies
+      if @conf['profile'].nil?
+        {}
+      else
+        @conf['profile'].locked_dependencies
+      end
+    end
+
+    def to_resources_dsl
+      Inspec::Resource.create_dsl(self)
+    end
+
+    def control_eval_context
+      @control_eval_context ||= begin
+                                  ctx = Inspec::ControlEvalContext.create(self, to_resources_dsl)
+                                  ctx.new(@backend, @conf, dependencies, @require_loader, @skip_only_if_eval)
+                                end
+    end
+
+    def reload_dsl
+      @control_eval_context = nil
+    end
+
+    def profile_supports_platform?
+      return true if @conf['profile'].nil?
+
+      @conf['profile'].supports_platform?
+    end
+
+    def profile_supports_inspec_version?
+      return true if @conf['profile'].nil?
+
+      @conf['profile'].supports_runtime?
+    end
+
+    def remove_rule(id)
+      @rules[id] = nil if @rules.key?(id)
+      @control_subcontexts.each do |c|
+        c.remove_rule(id)
+      end
+    end
+
+    def all_controls
+      ret = @rules.values
+      ret += @control_subcontexts.map(&:all_rules).flatten
+      ret
+    end
+    alias all_rules all_controls
+
+    def subcontext_by_name(name)
+      found = @lib_subcontexts.find { |c| c.profile_id == name }
+      if !found
+        @lib_subcontexts.each do |c|
+          found = c.subcontext_by_name(name)
+          break if found
+        end
+      end
+
+      found
+    end
+
+    def add_resources(context)
+      @resource_registry.merge!(context.resource_registry)
+      control_eval_context.add_resources(context)
+      @lib_subcontexts << context
+      reload_dsl
+    end
+
+    def add_subcontext(context)
+      @control_subcontexts << context
+    end
+
+    def load_libraries(libs)
+      lib_prefix = 'libraries' + File::SEPARATOR
+      autoloads = []
+
+      libs.sort_by! { |l| l[1] } # Sort on source path so load order is deterministic
+      libs.each do |content, source, line|
+        path = source
+        if source.start_with?(lib_prefix)
+          path = source.sub(lib_prefix, '')
+          autoloads.push(path) if File.dirname(path) == '.'
+        end
+
+        @require_loader.add(path, content, source, line)
+      end
+
+      # load all files directly that are flat inside the libraries folder
+      autoloads.each do |path|
+        next unless path.end_with?('.rb')
+        load_library_file(*@require_loader.load(path)) unless @require_loader.loaded?(path)
+      end
+      reload_dsl
+    end
+
+    def load_control_file(*args)
+      # Set `skip_file` to `false` between file loads to prevent skips from spanning multiple control files
+      control_eval_context.skip_file = false
+      load_with_context(control_eval_context, *args)
+    end
+    alias load load_control_file
+
+    def load_library_file(*args)
+      load_with_context(@library_eval_context, *args)
+    end
+
+    def load_with_context(context, content, source = nil, line = nil)
+      Inspec::Log.debug("Loading #{source || '<anonymous content>'} into #{self}")
+      @current_load = { file: source }
+      if content.is_a? Proc
+        context.instance_eval(&content)
+      elsif source.nil? && line.nil?
+        context.instance_eval(content)
+      else
+        context.instance_eval(content, source || 'unknown', line || 1)
+      end
+    end
+
+    def unregister_rule(id)
+      @rules.delete(full_id(@profile_id, id))
+    end
+
+    attr_reader :current_load
+
+    def register_rule(r)
+      # get the full ID
+      file = if @current_load.nil?
+               'unknown'
+             else
+               @current_load[:file] || 'unknown'
+             end
+      r.instance_variable_set(:@__file, file)
+      r.instance_variable_set(:@__group_title, current_load[:title])
+
+      # add the rule to the registry
+      fid = full_id(Inspec::Rule.profile_id(r), Inspec::Rule.rule_id(r))
+      existing = @rules[fid]
+      if existing.nil?
+        @rules[fid] = r
+      else
+        Inspec::Rule.merge(existing, r)
+      end
+    end
+
+    def register_attribute(name, options = {})
+      # we need to return an attribute object, to allow dermination of default values
+      attr = Attribute.new(name, options)
+      # read value from given gived values
+      attr.value = @conf['attributes'][attr.name] unless @conf['attributes'].nil?
+      @attributes.push(attr)
+      attr.value
+    end
+
+    def set_header(field, val)
+      @current_load[field] = val
+    end
+
+    private
+
+    def full_id(pid, rid)
+      return rid.to_s if pid.to_s.empty?
+      pid.to_s + '/' + rid.to_s
+    end
+  end
+end

data/lib/inspec/profile_vendor.rb

@@ -0,0 +1,66 @@
+# encoding: utf-8
+# author: Adam Leff
+
+require 'inspec/profile'
+
+module Inspec
+  class ProfileVendor
+    attr_reader :profile_path
+
+    def initialize(path)
+      @profile_path = Pathname.new(path)
+    end
+
+    def vendor!
+      vendor_dependencies
+    end
+
+    # The URL fetcher uses a Tempfile to retrieve the vendored
+    # profile, which creates a file that is only readable by
+    # the current user. In most circumstances, this is likely OK.
+    # However, in environments like a Habitat package, these files
+    # need to be readable by all users or the Habitat Supervisor
+    # may not be able to start InSpec correctly.
+    #
+    # This method makes sure all vendored files are mode 644 for this
+    # use case. This method is not called by default - the caller
+    # vendoring the profile must make the decision as to whether this
+    # is necessary.
+    def make_readable
+      Dir.glob("#{cache_path}/**/*") do |e|
+        FileUtils.chmod(0644, e) if File.file?(e)
+      end
+    end
+
+    def cache_path
+      profile_path.join('vendor')
+    end
+
+    def lockfile
+      profile_path.join('inspec.lock')
+    end
+
+    private
+
+    def profile
+      @profile ||= Inspec::Profile.for_target(profile_path.to_s, profile_opts)
+    end
+
+    def profile_opts
+      {
+        vendor_cache: Inspec::Cache.new(cache_path.to_s),
+        backend: Inspec::Backend.create(target: 'mock://'),
+      }
+    end
+
+    def vendor_dependencies
+      delete_vendored_data
+      File.write(lockfile, profile.generate_lockfile.to_yaml)
+    end
+
+    def delete_vendored_data
+      FileUtils.rm_rf(cache_path) if cache_path.exist?
+      File.delete(lockfile) if lockfile.exist?
+    end
+  end
+end

data/lib/inspec/reporters.rb

@@ -0,0 +1,60 @@
+require 'inspec/reporters/base'
+require 'inspec/reporters/cli'
+require 'inspec/reporters/json'
+require 'inspec/reporters/json_min'
+require 'inspec/reporters/junit'
+require 'inspec/reporters/automate'
+
+module Inspec::Reporters
+  def self.render(reporter, run_data)
+    name, config = reporter.dup
+    config[:run_data] = run_data
+    case name
+    when 'cli'
+      reporter = Inspec::Reporters::CLI.new(config)
+    when 'json'
+      reporter = Inspec::Reporters::Json.new(config)
+    when 'json-min'
+      reporter = Inspec::Reporters::JsonMin.new(config)
+    when 'junit'
+      reporter = Inspec::Reporters::Junit.new(config)
+    when 'automate'
+      reporter = Inspec::Reporters::Automate.new(config)
+    else
+      raise NotImplementedError, "'#{name}' is not a valid reporter type."
+    end
+
+    # optional send_report method on reporter
+    return reporter.send_report if defined?(reporter.send_report)
+
+    reporter.render
+    output = reporter.rendered_output
+
+    if config['file']
+      # create destination directory if it does not exist
+      dirname = File.dirname(config['file'])
+      FileUtils.mkdir_p(dirname) unless File.directory?(dirname)
+
+      File.write(config['file'], output)
+    elsif config['stdout'] == true
+      print output
+      STDOUT.flush
+    end
+  end
+
+  def self.report(reporter, run_data)
+    name, config = reporter.dup
+    config[:run_data] = run_data
+    case name
+    when 'json'
+      reporter = Inspec::Reporters::Json.new(config)
+    when 'json-min'
+      reporter = Inspec::Reporters::JsonMin.new(config)
+    else
+      # use base run_data hash for any other report
+      return run_data
+    end
+
+    reporter.report
+  end
+end

data/lib/inspec/reporters/automate.rb

@@ -0,0 +1,76 @@
+# encoding: utf-8
+
+require 'json'
+require 'net/http'
+
+module Inspec::Reporters
+  class Automate < Json
+    def initialize(config)
+      super(config)
+
+      # default to not verifying ssl for sending reports
+      @config['verify_ssl'] = @config['verify_ssl'] || false
+    end
+
+    def enriched_report
+      # grab the report from the parent class
+      final_report = report
+
+      # Label this content as an inspec_report
+      final_report[:type] = 'inspec_report'
+
+      final_report[:end_time] = Time.now.utc.strftime('%FT%TZ')
+      final_report[:node_uuid] = @config['node_uuid'] || @run_data[:platform][:uuid]
+      raise Inspec::ReporterError, 'Cannot find a UUID for your node. Please specify one via json-config.' if final_report[:node_uuid].nil?
+
+      final_report[:report_uuid] = uuid_from_string(final_report[:end_time] + final_report[:node_uuid])
+
+      # optional json-config passthrough options
+      %w{node_name environment roles recipies}.each do |option|
+        final_report[option.to_sym] = @config[option] unless @config[option].nil?
+      end
+      final_report
+    end
+
+    def send_report
+      headers = { 'Content-Type' => 'application/json' }
+      headers['x-data-collector-token'] = @config['token']
+      headers['x-data-collector-auth'] = 'version=1.0'
+
+      uri = URI(@config['url'])
+      req = Net::HTTP::Post.new(uri.path, headers)
+      req.body = enriched_report.to_json
+      begin
+        Inspec::Log.debug "Posting report to Chef Automate: #{uri.path}"
+        http = Net::HTTP.new(uri.hostname, uri.port)
+        http.use_ssl = uri.scheme == 'https'
+        if @config['verify_ssl'] == true
+          http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+        else
+          http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+        end
+
+        http.request(req)
+        return true
+      rescue => e
+        Inspec::Log.error "send_report: POST to #{uri.path} returned: #{e.message}"
+        return false
+      end
+    end
+
+    private
+
+    # This hashes the passed string into SHA1.
+    # Then it downgrades the 160bit SHA1 to a 128bit
+    # then we format it as a valid UUIDv5.
+    def uuid_from_string(string)
+      hash = Digest::SHA1.new
+      hash.update(string)
+      ary = hash.digest.unpack('NnnnnN')
+      ary[2] = (ary[2] & 0x0FFF) | (5 << 12)
+      ary[3] = (ary[3] & 0x3FFF) | 0x8000
+      # rubocop:disable Style/FormatString
+      '%08x-%04x-%04x-%04x-%04x%08x' % ary
+    end
+  end
+end

data/lib/inspec/reporters/base.rb

@@ -0,0 +1,25 @@
+module Inspec::Reporters
+  class Base
+    attr_reader :run_data
+
+    def initialize(config)
+      @config = config
+      @run_data = config[:run_data]
+      @output = ''
+    end
+
+    def output(str, newline = true)
+      @output << str
+      @output << "\n" if newline
+    end
+
+    def rendered_output
+      @output
+    end
+
+    # each reporter must implement #render
+    def render
+      raise NotImplementedError, "#{self.class} must implement a `#render` method to format its output."
+    end
+  end
+end

data/lib/inspec/reporters/cli.rb

@@ -0,0 +1,356 @@
+# encoding: utf-8
+
+module Inspec::Reporters
+  class CLI < Base
+    case RUBY_PLATFORM
+    when /windows|mswin|msys|mingw|cygwin/
+      # Most currently available Windows terminals have poor support
+      # for ANSI extended colors
+      COLORS = {
+        'failed'   => "\033[0;1;31m",
+        'passed'   => "\033[0;1;32m",
+        'skipped'  => "\033[0;37m",
+        'reset'    => "\033[0m",
+      }.freeze
+
+      # Most currently available Windows terminals have poor support
+      # for UTF-8 characters so use these boring indicators
+      INDICATORS = {
+        'failed'   => '[FAIL]',
+        'skipped'  => '[SKIP]',
+        'passed'   => '[PASS]',
+        'unknown'  => '[UNKN]',
+      }.freeze
+    else
+      # Extended colors for everyone else
+      COLORS = {
+        'failed'   => "\033[38;5;9m",
+        'passed'   => "\033[38;5;41m",
+        'skipped'  => "\033[38;5;247m",
+        'reset'    => "\033[0m",
+      }.freeze
+
+      # Groovy UTF-8 characters for everyone else...
+      # ...even though they probably only work on Mac
+      INDICATORS = {
+        'failed'   => '×',
+        'skipped'  => '↺',
+        'passed'   => '✔',
+        'unknown'  => '?',
+      }.freeze
+    end
+
+    MULTI_TEST_CONTROL_SUMMARY_MAX_LEN = 60
+
+    def render
+      run_data[:profiles].each do |profile|
+        @control_count = 0
+        output('')
+        print_profile_header(profile)
+        print_standard_control_results(profile)
+        print_anonymous_control_results(profile)
+        output(format_message(
+                 indentation: 5,
+                 message: 'No tests executed.',
+        )) if @control_count == 0
+      end
+
+      output('')
+      print_profile_summary
+      print_tests_summary
+    end
+
+    private
+
+    def print_profile_header(profile)
+      output("Profile: #{format_profile_name(profile)}")
+      output("Version: #{profile[:version] || '(not specified)'}")
+      output("Target:  #{run_data[:platform][:target]}") unless run_data[:platform][:target].nil?
+      output('')
+    end
+
+    def print_standard_control_results(profile)
+      standard_controls_from_profile(profile).each do |control_from_profile|
+        control = Control.new(control_from_profile)
+        next if control.results.nil?
+        output(format_control_header(control))
+        control.results.each do |result|
+          output(format_result(control, result, :standard))
+          @control_count += 1
+        end
+      end
+      output('') if @control_count > 0
+    end
+
+    def print_anonymous_control_results(profile)
+      anonymous_controls_from_profile(profile).each do |control_from_profile|
+        control = Control.new(control_from_profile)
+        next if control.results.nil?
+        output(format_control_header(control))
+        control.results.each do |result|
+          output(format_result(control, result, :anonymous))
+          @control_count += 1
+        end
+      end
+    end
+
+    def format_profile_name(profile)
+      if profile[:title].nil?
+        (profile[:name] || 'unknown').to_s
+      else
+        "#{profile[:title]} (#{profile[:name] || 'unknown'})"
+      end
+    end
+
+    def format_control_header(control)
+      impact = control.impact_string
+      format_message(
+        color: impact,
+        indicator: impact,
+        message: control.title_for_report,
+      )
+    end
+
+    def format_result(control, result, type)
+      impact = control.impact_string_for_result(result)
+
+      message = if result[:status] == 'skipped'
+                  result[:skip_message]
+                elsif type == :anonymous
+                  result[:expectation_message]
+                else
+                  result[:code_desc]
+                end
+
+      # append any failure details to the message if they exist
+      message += "\n#{result[:message]}" if result[:message]
+
+      format_message(
+        color: impact,
+        indicator: impact,
+        indentation: 5,
+        message: message,
+      )
+    end
+
+    def format_message(message_info)
+      indicator = message_info[:indicator]
+      color = message_info[:color]
+      indentation = message_info.fetch(:indentation, 2)
+      message = message_info[:message]
+
+      message_to_format = ''
+      message_to_format += "#{INDICATORS[indicator]}  " unless indicator.nil?
+      message_to_format += message.to_s.lstrip
+
+      format_with_color(color, indent_lines(message_to_format, indentation))
+    end
+
+    def format_with_color(color_name, text)
+      return text if defined?(RSpec.configuration) && !RSpec.configuration.color
+      return text unless COLORS.key?(color_name)
+
+      "#{COLORS[color_name]}#{text}#{COLORS['reset']}"
+    end
+
+    def all_unique_controls
+      return @unique_controls unless @unique_controls.nil?
+
+      @unique_controls = Set.new
+      run_data[:profiles].each do |profile|
+        profile[:controls].map { |control| @unique_controls.add(control) }
+      end
+
+      @unique_controls
+    end
+
+    def profile_summary
+      failed = 0
+      skipped = 0
+      passed = 0
+
+      all_unique_controls.each do |control|
+        next if control[:id].start_with? '(generated from '
+        next unless control[:results]
+        if control[:results].any? { |r| r[:status] == 'failed' }
+          failed += 1
+        elsif control[:results].any? { |r| r[:status] == 'skipped' }
+          skipped += 1
+        else
+          passed += 1
+        end
+      end
+
+      total = failed + passed + skipped
+
+      {
+        'total' => total,
+        'failed' => failed,
+        'skipped' => skipped,
+        'passed' => passed,
+      }
+    end
+
+    def tests_summary
+      total = 0
+      failed = 0
+      skipped = 0
+      passed = 0
+
+      all_unique_controls.each do |control|
+        next unless control[:results]
+        control[:results].each do |result|
+          if result[:status] == 'failed'
+            failed += 1
+          elsif result[:status] == 'skipped'
+            skipped += 1
+          else
+            passed += 1
+          end
+        end
+      end
+
+      {
+        'total' => total,
+        'failed' => failed,
+        'skipped' => skipped,
+        'passed' => passed,
+      }
+    end
+
+    def print_profile_summary
+      summary = profile_summary
+      return unless summary['total'] > 0
+
+      success_str = summary['passed'] == 1 ? '1 successful control' : "#{summary['passed']} successful controls"
+      failed_str  = summary['failed'] == 1 ? '1 control failure' : "#{summary['failed']} control failures"
+      skipped_str = summary['skipped'] == 1 ? '1 control skipped' : "#{summary['skipped']} controls skipped"
+
+      success_color = summary['passed'] > 0 ? 'passed' : 'no_color'
+      failed_color = summary['failed'] > 0 ? 'failed' : 'no_color'
+      skipped_color = summary['skipped'] > 0 ? 'skipped' : 'no_color'
+
+      s = format(
+        'Profile Summary: %s, %s, %s',
+        format_with_color(success_color, success_str),
+        format_with_color(failed_color, failed_str),
+        format_with_color(skipped_color, skipped_str),
+      )
+      output(s) if summary['total'] > 0
+    end
+
+    def print_tests_summary
+      summary = tests_summary
+
+      failed_str = summary['failed'] == 1 ? '1 failure' : "#{summary['failed']} failures"
+
+      success_color = summary['passed'] > 0 ? 'passed' : 'no_color'
+      failed_color = summary['failed'] > 0 ? 'failed' : 'no_color'
+      skipped_color = summary['skipped'] > 0 ? 'skipped' : 'no_color'
+
+      s = format(
+        'Test Summary: %s, %s, %s',
+        format_with_color(success_color, "#{summary['passed']} successful"),
+        format_with_color(failed_color, failed_str),
+        format_with_color(skipped_color, "#{summary['skipped']} skipped"),
+      )
+
+      output(s)
+    end
+
+    def standard_controls_from_profile(profile)
+      profile[:controls].reject { |c| is_anonymous_control?(c) }
+    end
+
+    def anonymous_controls_from_profile(profile)
+      profile[:controls].select { |c| is_anonymous_control?(c) && !c[:results].nil? }
+    end
+
+    def is_anonymous_control?(control)
+      control[:id].start_with?('(generated from ')
+    end
+
+    def indent_lines(message, indentation)
+      message.lines.map { |line| ' ' * indentation + line }.join
+    end
+
+    class Control
+      attr_reader :data
+
+      def initialize(control_hash)
+        @data = control_hash
+      end
+
+      def id
+        data[:id]
+      end
+
+      def title
+        data[:title]
+      end
+
+      def results
+        data[:results]
+      end
+
+      def impact
+        data[:impact]
+      end
+
+      def anonymous?
+        id.start_with?('(generated from ')
+      end
+
+      def title_for_report
+        # if this is an anonymous control, just grab the resource title from any result entry
+        return results.first[:resource_title] if anonymous?
+
+        title_for_report = "#{id}: #{title || results.first[:resource_title]}"
+
+        # we will not add any additional data to the title if there's only
+        # zero or one test for this control.
+        return title_for_report if results.nil? || results.size <= 1
+
+        # append a failure summary if appropriate.
+        title_for_report += " (#{failure_count} failed)" if failure_count > 0
+        title_for_report += " (#{skipped_count} skipped)" if skipped_count > 0
+
+        title_for_report
+      end
+
+      def impact_string
+        if anonymous?
+          nil
+        elsif impact.nil?
+          'unknown'
+        elsif results&.find { |r| r[:status] == 'skipped' }
+          'skipped'
+        elsif results.nil? || results.empty? || results.all? { |r| r[:status] == 'passed' }
+          'passed'
+        else
+          'failed'
+        end
+      end
+
+      def impact_string_for_result(result)
+        if result[:status] == 'skipped'
+          'skipped'
+        elsif result[:status] == 'passed'
+          'passed'
+        elsif impact.nil?
+          'unknown'
+        else
+          'failed'
+        end
+      end
+
+      def failure_count
+        results.select { |r| r[:status] == 'failed' }.size
+      end
+
+      def skipped_count
+        results.select { |r| r[:status] == 'skipped' }.size
+      end
+    end
+  end
+end